mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,465,400 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
1c3e8cef79 |
vfs-7.3-rc1.misc
Please consider pulling these changes from the signed vfs-7.3-rc1.misc tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
otI6AQCIwshv02UI9fmbTC9pFr8b+v/9IWQwdVULaH61HXgICQD7BE/CktL8nfRs
zCzGS6kBdWgiOA6bdVpgGGLqiMRnQgo=
=Kc+G
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull misc vfs updates from Christian Brauner:
"Bigger cleanups:
- The lockref dead-count handling is tidied up.
The open-coded check for a count below zero as the dead marker
relies on information the caller should not have.
- make put_mnt_ns() leave mounts connected. Destroying a mount
namespace disconnected its mounts from their mount points. So a
file descriptor still open on the parent of a mount point could be
used to peek under it.
Locked mounts were already kept connected to prevent exactly that.
But a mount is only locked when its tree is copied across a user
namespace boundary. So a mount namespace set up by a privileged
component had no locked mounts and its mounts were disconnected.
Passing UMOUNT_CONNECTED keeps every mount connected and prevents
that bug.
- vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix
that ago but didn't get to it. So now someone finally did it.
This kills the exception where the mode could be 0 when a directory
was created whereas every other creation operation passed it
explicitly already.
- move long delayed work for ufs, jffs2, hfsplus, hfs and affs from
the per-cpu system_long_wq to the new unbound system_dfl_long_wq.
None of that work relies on per-cpu state and the work item is
enqueued with queue_delayed_work() whose timer is global anyway. So
it may as well benefit from scheduler task placement.
Smaller fixes and cleanups:
- unlock_buffer() and journal_end_buffer_io_sync() use
clear_and_wake_up_bit()
- the pipe page pools are unified into a single per-pipe pool and the
extra wake_up(rd_wait) is limited to EPOLLET consumers
- eventpoll now computes its timer slack lazily in ep_poll()
- shrink_dcache_for_umount() keeps making progress on busy roots
- excess xarray nodes are freed in clear_inode()
- romfs detects hard link cycles
- the user path of nested backing files is fixed
- pidfd holds exec_update_lock around the namespace ioctl
- non-memcg-aware nr_cached_objects is skipped during memcg slab
shrink
- iomap_write_iter() always returns status
- mangle_path() is renamed to seq_mangle_path()
- inode timestamp accessors are annotated
- new regression test for pipe->poll_usage.
- a few documentation, kernel-doc and selftest fixes"
* tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits)
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
selftests/epoll: add a regression test for pipe->poll_usage
pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers
pidfd: hold exec_update_lock around namespace ioctl
fs: fix user path of nested backing files
fs: remove stale inode_insert5() kernel-doc parameter
fs: fix switch/case indentation in sysfs() syscall
fs: document semantics of kstat::{uid,gid} fields
dcache: keep shrink_dcache_for_umount() making progress on busy roots
seq_file: rename mangle_path to seq_mangle_path
nstree: add/fix struct ns_id_req kernel-doc member fields
dcache: use lockref routines for dead count checks
lockref: tidy up dead count handling
initramfs: fix typo in reserve_initrd_mem comment
fs/pipe: unify the page pools into a single per-pipe pool
fs: annotate inode timestamp accessors
eventpoll: compute timer slack lazily in ep_poll()
selftests/filesystems: add mntns cleanup test
put_mnt_ns(): leave mounts connected
affs: Move long delayed work on system_dfl_long_wq
...
|
||
|
Linus Torvalds
|
ab5ed08f2d |
vfs-7.3-rc1.lookup
Please consider pulling these changes from the signed vfs-7.3-rc1.lookup tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc ouj6AQCnBHstCt5RRimywLYU+eTmdKe203zRQYxXpwlYOAzm7wEAm1mIC7/Of6bD jkiJilcPDcyYcJsqwBw/Vcz5HR+v8wo= =TX6K -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs lookup updates from Christian Brauner: "This refactors lookup_open() and adds vfs_lookup_open() for nfsd. mnt_want_write() and parent locking are moved into lookup_open() itself. audit_inode_child() is also now called in lookup_open() on failure. That is the calling convention in vfs_create() and vfs_mkdir(), but lookup_open() made no such call when atomic_open() should have created a file and did not. And neither did the regular ->create() path fwiw. This also contains work to remove the unneeded excl argument from the ->create() inode op" * tag 'vfs-7.3-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs/namei.c: fix coding style in atomic_open() and lookup_open() fs/namei.c: fix kerneldoc of atomic_open() and vfs_lookup_open() fs/namei.c: update stale comments in lookup_open() Remove excl arg to ->create inode_operation fs/namei.c: update kerneldoc of atomic_open() vfs: call audit_inode_child() in lookup_open() on failure vfs: move create error && negative dentry case in lookup_open() up VFS: add vfs_lookup_open() for nfsd VFS: move delegated_inode retry loop into lookup_open() VFS: move mnt_want_write() and locking into lookup_open() |
||
|
Linus Torvalds
|
fff0150b02 |
vfs-7.3-rc1.kthread
Please consider pulling these changes from the signed vfs-7.3-rc1.kthread tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc ohHuAQCFeGhxqsb44KhuJaWXewiXbefr6eg31lXmxgSfg0DILAD/Tw/WmpiUbX5M H+/jh6NmLKnQ/ADjlWFRy3R1K1Il3w4= =jwPP -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull kthread vfs updates from Christian Brauner: "This stops kernel threads from sharing filesystem state with userspace. This work is about 3 cycles old and has been in -next for about that time. When the kernel boots init_task creates PID 1 and then kthreadd. From that point every kthread and PID 1 share the same fs_struct. That is why pivot_root() has to rewrite the fs_struct of all kthreads. The rewriting exists so that kthreads can use init's filesystem state when they want to. It also means userspace can move the ground out from under the kernel. PID 1 now gets a completely separate fs_struct. All kthreads are anchored in a private SB_KERNMOUNT instance of nullfs that cannot be mounted on and cannot be used to follow other mounts. Userspace init can no longer affect kthread filesystem state and kthreads can no longer affect userspace fs state without explicit opting in to that. Path lookup from a kthread now fails by default. It makes it deliberately hard to offload security sensitive operations into init's filesystem state from a kthread. Places that legitimately need to look something up there opt in through the new scoped_with_init_fs() which temporarily overrides the caller's fs_struct with init's. usermodehelpers remain the only kernel tasks that genuinely share init's filesystem state, since they execute random binaries in the root filesystem (excellent...). The visible result is that /proc/2/root is a nullfs with an empty mountinfo while /proc/1/root is the real root" * tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (26 commits) initramfs_test: use test init/exit hooks to override init fs fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE fs: stop rewriting kthread fs structs fs: start all kthreads in nullfs nullfs: make nullfs multi-instance devtmpfs: create private mount namespace fs: add umh argument to struct kernel_clone_args fs: stop sharing fs_struct between init_task and pid 1 af_unix: use scoped_with_init_fs() for coredump socket lookup initramfs: use scoped_with_init_fs() for rootfs unpacking pnfs/blocklayout: use scoped_with_init_fs() for SCSI device lookup ksmbd: use scoped_with_init_fs() for VFS path operations ksmbd: use scoped_with_init_fs() for filesystem info path lookup ksmbd: use scoped_with_init_fs() for share path resolution fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns() coredump: use scoped_with_init_fs() for coredump path resolution btrfs: use scoped_with_init_fs() for update_dev_time() scsi: target: use scoped_with_init_fs() for APTPL metadata scsi: target: use scoped_with_init_fs() for ALUA metadata crypto: ccp: use scoped_with_init_fs() for SEV file access ... |
||
|
Linus Torvalds
|
de03b17ec0 |
vfs-7.3-rc1.kfunc
Please consider pulling these changes from the signed vfs-7.3-rc1.kfunc tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc oqBnAQDzCTHIa0wColluZLaFVuL4pvipQzC7tjUUQCwPmy85EwEA2cyeguEkNYJZ SK3m4z8kfuZjO2tEOig+XCkmtVrSMQQ= =6gwq -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs bpf access updates from Christian Brauner: "This adds a bpf_sock_read_xattr() kfunc so a BPF LSM program can read a user.* extended attribute from a socket's sockfs inode locklessly. userspace already uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for other purposes such as a varlink registry. There has been no efficient way for a BPF program to read those labels back. With this a listening socket marked from userspace with fsetxattr() can be read back during bind or connect and acted upon on the connecting socket. That lets userspace mark sockets and later rediscover them or implement policy on them" * tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/bpf: Add test for bpf_sock_read_xattr() kfunc fs: Add bpf_sock_read_xattr() kfunc to read socket xattrs |
||
|
Linus Torvalds
|
9ea8d6197d |
vfs-7.3-rc1.iomap
Please consider pulling these changes from the signed vfs-7.3-rc1.iomap tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
oqOjAP9eZsO4M7OQpTKPgg3Sq2O9QCVgXBy4SVFba7DrbZHLZAEA/NWE+4udJzeL
j1Xb2VAyMc4S+Ze/O8sMml5Dyh4V5wE=
=34r1
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull iomap updates from Christian Brauner:
"The bulk of this is the conversion of iomap to a single ->iomap_next()
callback and thus finishing the move to an iterator model.
Every iomap operation drove its iteration through a struct iomap_ops
holding ->iomap_begin() and ->iomap_end(). iomap_iter() only ever sees
those as pointers. That means every step of every iteration is an
indirect call.
This collapses both into one ->iomap_next() callback that finishes the
previous mapping and produces the next one. This lets callers inline
the iteration loop and pass its ->iomap_next() as a compile time
constant. That means the compiler can turn it into a direct and hence
inlineable call.
This also allows future callers to express custom logic to drive the
iteration forward better. xfs, btrfs, ext4, ext2, erofs, f2fs, gfs2,
hpfs, fuse, exfat, zonefs, ntfs, ntfs3 and the block device mapping
are all converted. No functional changes are intended.
This also adds a simple direct I/O path for small reads. On Gen5 NVMe
the __iomap_dio_rw() dominates 4K random reads. The same single-core
io_uring poll mode workload reaches ~3.2M IOPS against the raw block
device but only ~1.92M through ext4 or XFS.
__iomap_dio_rw(), iomap_iter(), iomap_dio_bio_iter() and kfree() were
at the top of the profile. The new path is very lightweight if no
special behavior is requested. The bio comes from a dedicated bioset
and laid out so the whole request is a single cacheline aligned
allocation. Completion runs inline.
That takes ext4 from 1.92M to 2.19M IOPS in the original workload. fio
shows around:
- 4% at libaio queue depths of 64 and up
- around 5% for io_uring
- up to 10% for io_uring poll mode at depth 256
on both ext4 and xfs.
A few other patches:
- iomap_folio_mark_uptodate() lets a filesystem that writes into the
page cache outside the iomap read and write paths keep iomap's
internal uptodate bitmap in sync, which fuse needs for
server-pushed notify stores before it can enable large folios;
- two fixes for iomap_bio_read_folio_range_sync(): a potential crash
when device integrity behavior is changed and a missing
bio_uninit().
- a folio batch release fix on iomap callback failures
- FGP_NOFS is dropped from iomap_get_folio()
- documentation fix"
* tag 'vfs-7.3-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit
iomap: don't free integrity payload that doesn't exist
docs: fix grammatical error in iomap docs
exfat: convert iomap ops to ->iomap_next()
fuse: convert iomap ops to ->iomap_next()
hpfs: convert iomap ops to ->iomap_next()
gfs2: convert iomap ops to ->iomap_next()
f2fs: convert iomap ops to ->iomap_next()
block: convert iomap ops to ->iomap_next()
ext2: convert iomap ops to ->iomap_next()
zonefs: convert iomap ops to ->iomap_next()
erofs: convert iomap ops to ->iomap_next()
ext4: convert iomap ops to ->iomap_next()
ntfs: convert iomap ops to ->iomap_next()
ntfs3: convert iomap ops to ->iomap_next()
btrfs: convert iomap ops to ->iomap_next()
xfs: convert iomap ops to ->iomap_next()
iomap: add ->iomap_next()
iomap: use GFP_NOWAIT when application for iomap_dio_simple allocations
iomap: decouple simple direct I/O reads from iomap_dio_rw
...
|
||
|
Linus Torvalds
|
3d1f952677 |
vfs-7.3-rc1.fat
Please consider pulling these changes from the signed vfs-7.3-rc1.fat tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc onKkAP40wNdwV6l2ve+dioDeEAd7L8hBANbh6X6p7s8s1WUaQAEAtdq8PsA2UqBy RjS/Mj5X+MTttydrrp3A7FQdhf5/lwQ= =DHKe -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc1.fat' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull FAT update from Christian Brauner: "This rejects names longer than NAME_MAX in msdos_format_name(). The VFS only enforces PATH_MAX rather than the length of an individual component. open() on such a path component reported success for a name far longer than NAME_MAX" * tag 'vfs-7.3-rc1.fat' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fat: reject name longer than NAME_MAX in msdos_format_name() |
||
|
Linus Torvalds
|
cd051cfe1e |
vfs-7.3-rc1.failfs
Please consider pulling these changes from the signed vfs-7.3-rc1.failfs tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc ouz+AQCXKHb1Ay9ra1RG+dGu8mCpVZLebMt/+VO0/beMCqiqWAD8ChgvsFqObmr5 8vLKOnzsSMeglRYGPL81h3xnaILRIQk= =0qwg -----END PGP SIGNATURE----- Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull failfs filesystem from Christian Brauner: "Add failfs and expose a FD_FAILFS_ROOT sentinel. This allows userspace to shed their filesystem state completely. A process with its root or working directory in failfs must anchor every path lookup at an explicit file descriptor. Absolute paths, absolute symlinks and AT_FDCWD-relative lookups simply fail. Failfs is the counterpart to nullfs. nullfs says adds a permanently empty, immutable directory whose lookups fail with ENOENT but which can be opened, read, stat'd and mounted upon. Failfs on the other hand fails every operation. The root cannot be opened at all. A single instance is mounted during early boot via kern_mount(), which makes it logically distinct from every mount namespace. This is accompanied by a new fchroot() system call which makes chrooting via a file descriptor a first class concept. It's possible to chroot into failfs as an unprivileged user provided the task has no new privileges set" * tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Documentation: add failfs documentation selftests/filesystems: add failfs selftests arch: hookup fchroot() system call fs: support FD_FAILFS_ROOT in fchroot() fs: add fchroot() fs: support FD_FAILFS_ROOT in fchdir() fs: add failfs |
||
|
Linus Torvalds
|
d31a688a49 |
vfs-7.3-rc1.efs
Please consider pulling these changes from the signed vfs-7.3-rc1.efs tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
os6RAQCmvZhzfQ18Gz7FmQkeXVYJ4J1HKg0shTHdZFM+Fg+iXwD5ARD7vWqIrcxs
8etF+tlQeeB+kCiel9XJUnDfu6i1gwE=
=zo4v
-----END PGP SIGNATURE-----
mergetag object
|
||
|
Linus Torvalds
|
b9cba7ebfe |
vfs-7.3-rc1.binfmt
Please consider pulling these changes from the signed vfs-7.3-rc1.binfmt tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
ovtnAQDiMF2CvH2vr/eiUEUNdDjeyzRKipkh3a9krO0XbFxpnAD8CZypBFw/oWOQ
7z3PDGhHp10ie6KYC45XbUc+a4b6vgQ=
=X9RZ
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull binfmt updates from Christian Brauner:
"This contains a bunch of work for binfmt_misc. It fixes a bunch of
old bugs, reworks the locking, and then extends the format registry
so a binary type can be matched programmatically and its interpreter
computed per exec instead of being a fixed string recorded at
registration time.
This allows nixos and other to e.g., implement relocatable binaries
meaning the interpreter/dynamic loader can be determined
programatically, say found relative to the binary. The mechanism is
flexible and can support other policies:
- Handler lookup is now an rcu walk. An exec that matches no
binfmt_misc entry should now never write to a shared cacheline
- remove the VERBOSE_STATUS and USE_DEBUG compile time toggles
- convert the entry file to a seq_file which simplifies things quite
a bit and kills a lot of custom logic
- make flags proper enums
- rename struct Node to binfmt_misc_entry
- allow entries to be removed with unlink(2)
- Add the ability to attach bpf programs to binfmt_misc entries so
it's possible to dynamically choose the execution environment such
as the loader or interpreter on a per binary basis.
A handler is an instance of a binfmt_misc_ops struct_ops with a
->match() and a ->load() program. match() decides from the entry
lookup walk whether the handler applies under the same
registration-order. It can read file content as needed not only the
prefetched 256 bytes in bprm->buf.
load() then selects the interpreter and stages it through the new
bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and
bpf_binprm_set_flags() kfuncs.
Handlers are published in a registry keyed by the registering
task's user namespace and activated through the existing text
interface with a new 'B' type carrying the handler name:
echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register
The permission and namespacing model is unchanged. Activating a
handler requires the same write access to an instance as any other
registration. A container mounting its own instance escapes the
host's entries exactly as before. The computed interpreter is
opened with open_exec() under the caller's credentials and goes
through full LSM vetting as the next binprm level. A program can
only ever redirect the caller to something the caller could exec
anyway.
- Two dispatch modes are added. So far the chosen interpreter owns
the whole process identity (argv[0], /proc/pid/cmdline,
/proc/self/exe all name interpreter information). So relocatable
find the dynamic linker instead. Also a binary passed to execveat()
as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips
because AT_ENTRY and AT_PHDR do not match the exe file. So PIE
symbols are unrelocated.
This adds transparent dispatch which allows the interpreter to load
the binary through AT_EXECFD and leaves the argument vector exactly
as the caller built it and labels mm->exe_file and comm with the
binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector
bit. The interpreter keeps control of mapping the binary.
The second mode is loader substitution. This allows a binary to be
executed natively and only the interpreter to be changed.
- Last, interpreters can be bound at registration time. Each
interpreter is opened by its own write with the credentials the
entry file was opened with. The program picks one per exec with
bpf_binprm_select_interp().
Ucounts are used to properly account for pre-opened interpreters
via /proc/sys/user/max_binfmt_misc_interpreters"
* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits)
binfmt_misc: document the pre-opened interpreter limit
selftests/exec: test the pre-opened interpreter limit
binfmt_misc: correctly account pre-opened interpreters
binfmt_misc: document interpreters bound by a 'B' entry
selftests/exec: test interpreters bound to a 'B' entry
binfmt_misc: let a 'B' entry bind its interpreters
binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp
selftests/exec: share the bpf handler preconditions
binfmt_misc: document registering an entry disabled
selftests/exec: test registering an entry disabled
selftests/exec: let binfmt_flag_supported() return a bool
selftests/exec: check that a binfmt_misc instance cannot be pinned
binfmt_misc: let a register string create an entry disabled
binfmt_misc: document loader substitution
selftests/exec: test binfmt_misc loader substitution
binfmt_misc: let a bpf handler request loader substitution
binfmt_misc: add the 'L' loader substitution flag
binfmt_elf_fdpic: consume a stashed PT_INTERP substitute
binfmt_elf: consume a stashed PT_INTERP substitute
exec: carry a PT_INTERP substitute in struct linux_binprm
...
|
||
|
Linus Torvalds
|
043d7a2b40 |
ipc-7.3-rc1.misc
Please consider pulling these changes from the signed ipc-7.3-rc1.misc tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
ooOoAP9pECC4lIvizRLhV+8id21aYyyHP6svcZDgMv7yI8E7qgD/Zaxt0hS/rsLY
IUA9iphoZ6pWyPyv/Lq6M0mk3wyoigM=
=KcXC
-----END PGP SIGNATURE-----
mergetag object
|
||
|
Linus Torvalds
|
8d3ae59288 | Linux 7.2 v7.2 | ||
|
Linus Torvalds
|
fd923b32d7 |
- Make sure a delayed sched entity's runtime stats are updated at the right
time so that it receives the proper lag compensation -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB/CQACgkQEsHwGGHe VUq4Eg//ZeldqtFqUxohjcy5ZrgJ9dhdxwRfqZgYhZCSqTJHVLqAxWVAHnJZWfiz Vh63rnt78rIPpVX6E/lZLnYm2VwhEO6P6piMzG4CVlh2pMySjhoRIQ3ufNAQRt0o P79Y29rLhDhHkOaL+jjgSr+ePiDzerrkBfYHK0wJ+BAjphjWxML1wYyCGwhWk/Lu KuXN/jzbEbAn2QWEwEy9KyxztzJlTYTE+l8jiGfRywAeZOBo8HaXg0HhuCwLnaXb yPmarhof2/7XUdW/CBGYggLaXF+mW6VeMaiqdhxSKl48KMpIfPnBC99/YCJy6vmQ pD+kOiysGSFy+3vMbTvjwOYV8T3g7LOpeVkY8KkVmAHUFVF9wBSyPULyooNuxGS9 2pBv6Uz2ojm3wMVk+gggt2VU5uVNLsn9IKpNObyuBRDkt3My4Jej3cQ89LeqyS8Z q49JbAhEwCRfGpxq92WW6izMWjOnduhiTd9TXF/WoXVtcT9ZSbyxJ3sCxbTBrJxd na7xln2xsR8w9+G91DmmNPRnBtBkBOJ6xRGacKDeV8dcfKcZGGH6/sRMN9mIhP8v huCVazSwNCVWDaHn8o/ORBJ0dEJ/536a806ysYfB6MdNzZYtU8iepCj5Lr+uAG/Q W49ftqYFst9o22wT2i4ZdTfrDrkbekVU67BLv9yu8VcmoQJgt90= =bK3W -----END PGP SIGNATURE----- Merge tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Make sure a delayed sched entity's runtime stats are updated at the right time so that it receives the proper lag compensation * tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Update time before requeueing delayed entities |
||
|
Linus Torvalds
|
240de1acf3 |
- Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5) and
fallback to the physical one instead - Fix a build error with ARM rpc_defconfig and function tracer enabled -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+qQACgkQEsHwGGHe VUr7zQ//d2p80ASoa/3p6qzDs5FiySg2tWEfdRp6PoWDeonu5xVcXHs4GJyFFunP X7pu4kZ+gXq5RoWuk/ClFschaakeij0XtNCjMrpA7ZZpqwBwx387nv3v/9KecU3n IGqS6bz22d/99te9cMo+1vj3gm/PBIE3SOEnwQQ7oD2pAc2TzdLeoXo554EE5zZu tBpgdCz4fDcvmpr9sXzw9fDjgJgPjlVJYq/+juCtxXAWQtGJnHWCqGdMxbOtzHHo E2lLQhZNgC3Vi+jbTYB7mpa70R9iS8TmjuosjKpan3uxakQZnE/+pqN6xFpDh3Ho 090dtBFOUYxx7LDcX6RjXrbddIaHwZNCP1W6OB0EKPUntcpD6MMo4GMBURUxJ4mO TT0gCtd1bsgYhNwZDVBUxhwoqM1e+EtL44ndT26E0HnIIT0gqr4QE6ODvFpeUQmj 2sNdnBSslrLYeHYypBFRRo3aiDmfYCrML2z/OWEdRmAOYvUssJP4euXrBbInobd5 VtBxjjQmBCSiV7nD0vor9eU5kJ4y6VNfiDDBuByNBzIWliMznLNgN92zAGPn7uwR IZ1wBWSbMYoc2C8h0CIPax1J+S517G17WVhMbJnYNlg9SzMAxttBWoHHvrdGMfW8 Nua9plybvDVa+SRgCgJl7fiY19/UtXh/9NxHFQtcJnqR0eQfxJs= =IlDf -----END PGP SIGNATURE----- Merge tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Borislav Petkov: - Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5) and fallback to the physical one instead - Fix a build error with ARM rpc_defconfig and function tracer enabled * tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer tick: Include ktime.h and jiffies.h in linux/tick.h |
||
|
Linus Torvalds
|
7820dd4a12 |
- Prevent a lockup when rseq grants a timeslice extension
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+IQACgkQEsHwGGHe VUoLoA//UiK75T3O49g7pPmQh3lOqoadcvFduoGPVulWr9MqMYb9la+XRAPTO2aX lMldJhHoQBdL4chQU/2r1LgcM9i2GF753ssqO+MhAQHrDUMhZD87fRkQt+0e1jEc iAfjQCWVV7+abzsgKbZOlvXeYBFY6Bcy/EwGr9OhNPn1Zg6yGT73gV/ihgc1KYtj gyUCNjgu5n5UWLZOsAfy0JpSxdeHqCaydYKRRIWbQrbjlp+fauRPtbyOXua3mwNt gCnBpXnB3rD3R98KGr9C1GHg4DhwTSWZIQj67KMSnEKLco3fzhzq1PW1GwY3UFqn 81OKGIqKHP+VDJTNsk4F0zrXLqG3NWaKwCu9jLV5yhA1z3/4GXNAE3iOT8DT3lmp upDnQ85aNkPSruF/ZjFxeNT3qrPOLCyMz0p/6qhZN7A3V/4R+B9vRYpvWZunvzvC k5hqeV1NyeRSoqvEp8ySH++v7Ifny2LbltIcuL+9wWUvRCb45ACQTgsjfIIRrm8F 5mGBRyZs53lU7NthyE1FScNrVUFw7HaWAIapzaZPZIqhNh2+MAOODclTggYp0Y2A tIEGLohrsuEiPDA3xwa+6a+826M7Uan0lfIVV39BwTM2axuMOuapn/Ou5GmPSvx6 guE0WRugo7TN5st8e+Go0ZrUMXzcQ61G3fdNJOR7UIbQROmrgEo= =7htY -----END PGP SIGNATURE----- Merge tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq fix from Borislav Petkov: - Prevent a lockup when rseq grants a timeslice extension * tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Prevent hard lockup on granted time slice extension |
||
Charlie-cy Wu
|
d6e7d57ed9 |
wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
Split mt7921_mcu_regd_update() into two functions to prevent recursive
mutex acquisition. Introduce __mt7921_mcu_regd_update() as the internal
implementation that assumes the mutex is already held by the caller,
while mt7921_mcu_regd_update() remains as the external interface that
handles mutex acquisition and release.
This fixes a deadlock issue when mt7921_regd_set_6ghz_power_type() is
called with the device mutex already held. Without this change, calling
mt7921_mcu_regd_update() would attempt to acquire the same mutex again,
causing a recursive lock deadlock.
The __mt7921_mcu_regd_update() function can be safely called when the
caller has already acquired the device mutex, avoiding the deadlock
while maintaining proper synchronization for regulatory domain updates.
Fixes: dc2608cf5224 ("wifi: mt76: mt7921: refactor regulatory notifier flow")
Signed-off-by: Charlie-cy Wu <Charlie-cy.Wu@mediatek.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|
Linus Torvalds
|
d5b95e612c |
Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
This reverts commit
|
||
|
Linus Torvalds
|
9da3fc37f5 |
- Prevent the use of exited events as group leaders
- Avoid use-after-free of an event's group leader by promoting detached sibling events to standalone entities and correct related accounting and state transitions -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB6xQACgkQEsHwGGHe VUpWFQ/+KyU6R2DC48ifpChzgTFmQ2gmIjy1IIsWSGmdSbyD5CEWar8hHDRq1X9r peuQizTXTQ2Ze75atTMIBExR6eUFYb2sKA1HpobcGnB96cpK8e2vmxhvXoHgB3IZ TYDXQ1RMPnbyTn2rCQwr5cgSq2Qe7w2tMXMQKzfmDxP1r7cE81zJVFAsRdVVZP75 kvlcCL43pIwzxzP7sDb9bU9lTkW2Sw83dLIp3jBd3iiUpIQpwqV+UG3/fkInV58n L56cYFsovLbvWdxq4oj6cFwRBmvyrYKV0zkT+zW0SO2AzlVhfwCD/o74hxLwrN// Gas0d51uQfWt+5M7s6T0KFQYBfClG4uoIi2yh7zXxWEXyhcNuvmAVrY3xiQxReIi m88+ByWHfBc/mYTHKWJAqb8sHhJiktU52T55ktOJaPNGczA5+O/4alnOg3Kxvw7d CXp1raxJLqDxvd7Ubu/LVjWY96ds+fAaC15ydC6Lh08b9LPhA8rRCavf7NeSOzOD E1NA3QLS3TwbrTboaGqLMmzOLPkBBZ+28PUASg1ZpyfGnw91Ggv/gOVNUgr5PvMU D/gzRCwEYfDdhOrIHzGrfJ1fwj4qFsZ6HSge3sHDj8/BCcQYj/zmlTKe0CHKbaiy D7bkLNwdBc0z+eh5T7UfCYodUu0qiiek5Y0G3q8FVad0mFDYtUA= =moR8 -----END PGP SIGNATURE----- Merge tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Prevent the use of exited events as group leaders - Avoid use-after-free of an event's group leader by promoting detached sibling events to standalone entities and correct related accounting and state transitions * tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix group leader use-after-free after sibling detach perf: Reject exited events as group leaders |
||
|
Linus Torvalds
|
16429bb371 |
- Add a proper kernel cmdline option to control the TLB invalidation method on
x86 prompted mainly by a recent finding on AMD related to INVLPGB/TYLBSYNC invalidations. Having the command line option is simply another way to alleviate the situation short-term -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB44wACgkQEsHwGGHe VUqKSRAAgQKrFw3mH29qsNGjS0GH1m1B6DShBB6/BwJb716gGNfFV/EmYrcwRM4+ GTSA+LGLkKrb45gR+PkKkyoiXDPB/OzfmSlNvD+VCt1t78RdHCXLByye7SxxFjV/ smboswwphQJPLJ8iTeJn+I1jbfC45Wla1hlMgCdHC7tTyyBOPfg32JdQ37cnd2PE 8igsVVhMbEvszhbDrjVAWWUUjlWEjax8ix4rEKMV9J9zETgurK6Vy/G4QNTePSQU cc31FFUp+z+iBNWjCv1jhsuxUbxsH4u7SM3x18cTmgfKz03DQwVnCafkGPy8Rs2o nIdgojAnDginPQ0CsGvB1la7zHQ2MFtBRbNabW+m6WGs2OdwHs1+ATcm0/bFuQBh UqXic8fZ9jYsoGwRfqy/Nsg1ywkrm+IJ5RxSD1+wreGgYPPpEk5tzs5tx4vPFemX dm2ZizKr+kDxZThdTutwV0WY1A/xaix8M5y2poXb929zMy6E+sMwe7fjdnFSZph4 I84PzW4vlH5BTnEK96ROl+ZB4tTMLGBGM/3ymtlmeXAkLiyrj10f+QdKCF1GPHsO Ljv0LVtVL6h4/AJzoV6mYNLCOQUmooMkwwvTYWoHZ3yoqjHGWjGlWDyx7b5uL6BY mFv81rxp0TWcFKLxv8g737NLKH95JAbP9/bKbldc9rmMl/tBOKE= =1btz -----END PGP SIGNATURE----- Merge tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Add a proper kernel cmdline option to control the TLB invalidation method on x86 prompted mainly by a recent finding on AMD related to INVLPGB/TYLBSYNC invalidations. Having the command line option is simply another way to alleviate the situation short-term * tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Add a tlbi= cmdline switch |
||
|
Linus Torvalds
|
dcb68831ea |
block-7.2-20260815
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqBJfoQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpnZvEAC5y7aQuMkr++q00K/+gkRF2mef/kZPyySR N7alVJW69FgAluun+2MD9Sg1SXNXKlJ+8WAouKwhwbo/LuzzxdrJhJ8FO+94JTqn Dnf01ZCsbSU2KU1/D5Nk81vJTJMHTAmaefvejdJ1X0R8arBNLJ+8TZRRtuxixyez 6kt5HZTEY4n7WtkJs1sDUrbUCYt3jGXRz+sE+bNSzNFOCaTDBqCEquucZpa5QGRl Z7uVdHmpl8aQBCPNJq3H9l3HCav3FYCP8j+6DOzw8wNamlFdBj7ALldEz6uX1Kr9 EySUjW5MT9WwkN6dbSGOmF5bNQYuO8Umv0VsWTnIxXmEb34Jsz7PwVKZ+lJydsp5 Lm1JN9qT0uvN0CHyAL4ni3FnsTZnWDiTozBrZ4+vEPO8jRhTHg52eWtF4kfpaMxJ h2gw0MmPW+TaMQ13EiJ6fqppm/BrqtsX7WBKyKyflZIDXTy+KOoXxaiMO/IDMV0i ttS3yc6qLtvTR9BacLKlGc6YkiP4R9/1xSLWpOjNh18qljzgFFYjxOuszbcCE0/p vrefCd8J14HcCt5Qlw2XGYBptowbsNkEJ/k6L8Og36RAnyYzE84kbfVpiWddk0EU WqwAFWKc1J+1Ujf0TvmiprU1OfCPPeNp2xbDMMCGMRgLb6WSDUgUwBTiM9Hl2TmN N59eL2LfxA== =jmZj -----END PGP SIGNATURE----- Merge tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fix from Jens Axboe: "A single fix for a regression in this cycle, where drbd would leak shared secrets over netlink. This restores the behavior to match what we had before" * tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: drbd: don't leak the shared secret to unprivileged netlink dumps |
||
|
Linus Torvalds
|
0bae94aab8 |
io_uring-7.2-20260815
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqA/oQQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpj4ND/9OYcaM9+R/w7sv5+gefzm0omHhlLeg1nZ9 RCUKvG86yq2PaNQfL4Tu+xJAiAMoW1maL0BIhLITzB4Q7X+L6MA6ddEi7180YvoH J3vimltNwJRdwRwQVFgjMI+L5DpBbM864s8Uk53Dj8nYl6pNh/0rcVxxjEfy/6Mz XyT5lijBXSHieL5qynLxPnHyz5jLq0Y/Y9uVWhPxRuYYwrOjWNVPugsnrg17vNpC 3m9OwDzYldsAvoJehd8d6jrDGU/yxRynvP9NV8UfMnwg9k3F+C1f0PdbUrVwQlHh KqmpGluSpYyPuoyL82nS3WUpZ3iTpCvzPEl6g3HpKK3xo2DutaohrqLFt0q/oJd0 B1LoMuIs7nO486ZoodtyvzWWevkEFbKtYlOleLYhYX9N+oOPRczsO64ZL3lyT2MG FsNWaiyN6F5VlI4UAZyxg1PNqtTFutcU6WZjrsWVhOOEvq+rf5on1RgXH/i6LR4n DxEBTXeVrBUWOT0+Y2txxHz6T1UbcWkqdpk781dOZY+HCTg1MVCha20x3YttASBd 9JY03+JSolbBFzocaFXF/mWR1MGJdATWu3mutrdNoboeUiy5R/Kb3E81+a0CCR2K fI0TQ9RhQ+UxI8XW7IkxlTK/6bSyxiEIudgv0sYmKEZgH9O8SNY6ZTD8MeuA1fVN YgbVYoS8eA== =vArh -----END PGP SIGNATURE----- Merge tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a potential issue on 32-bit x86 with PAE" * tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rsrc: reject overflowing regvec bvec byte counts |
||
Christoph Böhmwalder
|
c71bf113df |
drbd: don't leak the shared secret to unprivileged netlink dumps
The conversion to explicit netlink serialization dropped the
exclude_sensitive parameter from net_conf_to_skb(), so each caller has
to sanitize by hand. Two dump paths were missed:
drbd_nl_get_connections_dumpit() and the volume-less connection branch
of get_one_status(). Neither op carries GENL_ADMIN_PERM, so any
unprivileged local user could read the CRAM-HMAC secret.
Add a net_conf_to_skb_sanitized() wrapper and route all three callers
through it.
Fixes:
|
||
|
Linus Torvalds
|
3eb40771c0 |
SoC fixes for 7.2, part 3
These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp/kkEACgkQmmx57+YA GNn0sRAAnDh3M8YkrmeGdU4aLCEIFDa+SB4+5OF2ANtjunGy3kUlPj1f9y9Sk7aq CEA2foLgAOThE7anz3VrV5RC+OHBqfe3OD39kMqdlTJlqZNLpVEbqFsyoMr8owAw zpfwDl8n1u9ROjGEyQ7t6QAE512ZLbwZ3wducoQPFGXZfjTpiuF4P00lpXa729xF H+Pb0WOMz3zytIfGKvKx4RWkiH0/xatiLoy0AO+73b2lCQgkJF4bhdkM+G5XAIvG XBhzO488Pu9vuoXpNnY0lizE2xZiJdhBJkR8/Ad0KrTlaLsjwJkF237ozWQ89F8U /00wS8zE9FXsEQNw9uJj7EjW7nKItxTloq3MELjoXbGV7xW5sEsjWZM3xsvFX5rD uJo4laNmjp7LZgTvlOZ9T5HM3XIMes3MNTqa4qx0bmrpxwy8BiaTuED9ugrUAIkv xR2xejKQdFEIEfJRga9YSVbVhF1fDH0dFG+8BVchx6npFWwFRk/RI0JycFGqUul7 8CNXuweWNaVb0Q/zfwWz99pVNqdDySJpAMh4Pl4GKB++jYRvnHU4sCSqDYrkqWRo UGMpZhuXHpwzVWu3B/gPdk2YW/Mo1jfGN6dPFP3JsfdQx1BaUx/2j4ggJn20nTUw v7bBU2i0ljMvNkClCqY8sIfgWDxiI1vsFzabW5o2PRzm8R+jm94= =xgY+ -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra" * tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 arm64: dts: apple: t8122: Fix I2C resources optee: ffa: Add NULL check in optee_ffa_lend_protmem |
||
|
Linus Torvalds
|
5e060ff9d1 |
OpenRISC fix for 7.2
A bug fix found by researchers.
* Ensure to mask all privileged bits when restoring the supervisor
register from sigreturn.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqABmQACgkQw7McLV5m
J+TL9A/7BmXvg+A5KT0xKxYrC//OCvD5dGwwKVhc5tEtNhpcWZU4fQo9WioRUpcz
OfbBcKN4RGrpm9Do685mqc2+nOGFcK9SId6eN47ri2G1ZJ1+wXE1IVKLIddlpBzp
rBJJyStBAKG2ICQfgoKM26JGbRttH19hJWSDITLzA2vAMp2gxpV7I1tSiLMrbOym
e/fKuclQ2tlH3DX+CJrRia/azeKRMjhlTCsSCH+FQSG+oegtCd6PP+rWi+i7cIas
pdSrDes+ES6LcGncK+uaNQfIi4D9tm37POYOK1zq4cyQknl4yl0mCWzHDegHocM3
EMAeZXgIxWR2sDn/xGl42gXsEjsIxgwUn9eufvAaNNVomFKOE8cVTsTAI7sgOCsj
9eiLLTCAQdGt8wiKYZLfnSm/tkIrtUs+Uc0v1OWslWUN9pVOuhiE5RYVwt6oOgyf
/16K0OFVggElHSyCkk9WPWryER1fg2n/eaOHflyOCO7YaQj9LL2e6TkVae7jQ+re
vZ1ZgNuSO9ZchcemvtQ0gH28sceRy+R2ICQV7ytuR+7Isxk1kQwXuKFhjNkKcy35
pTVFaFY1d/PwrtgUglk45/9ITFLJZNiz4ToE8jrP8P9+DlQhdp7tmZ2gNmtPb3Ll
H0fOU2Bh4QeAQm4T0XDGlm1U2eGA5gy3HFUUNMXomLdNfpT2vIU=
=p9Ll
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC fix from Stafford Horne:
"A bug fix found by researchers:
- mask all privileged bits when restoring the supervisor register
from sigreturn"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: signal: do not restore privileged SR bits on sigreturn
|
||
Ali Ahmet Memis
|
32ef1b30ad |
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space. All
other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way. The ptrace GPR regset
already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.
Fixes:
|
||
|
Linus Torvalds
|
15ef2f78c4 |
Input updates for v7.2-rc7
- A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCan/qAgAKCRBAj56VGEWX nIwLAQCryq8oWRzTY1H7QurNDJ89vSwdRJ8CxiLqQgJmWCzgzQD/Vr9SJmWacfn1 TEtDiqHoRSk2wOrZaSDRgsWTH2BOYQI= =RCXW -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. * tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: sur40 - fix V4L error path cleanup Input: sur40 - fix input device registration ordering |
||
|
Linus Torvalds
|
dac3e89a2c |
drm fixes for 7.2 final:
scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmp/eCcACgkQDHTzWXnE hr4BoA/7By6sGa+PelN5D3XzzJCHWd8/G/A3TFAFLrtpVK6M84qzNHenGFTNO1SF 3stK9CANA5GmXTudR3UJ4/ZagTde2ZU2hI0tHwOlldRvV91+Ed4lTcr6Kf4xzSnP R+Z3KZ/ggvGpKb628Z7hbwhNBkbkTY4TgotY0vCGK59t1M9Is0b3rMDB9ok7Z9ET B2nQr6UQ/3rb7aoOm0cYik2vTplTI7P1pchq0yKaXwZLNGlmuf556u/t3zsb2+3T E2ouifY82di75Fq+mQFhr4IP9SnFukxeXZw0mkykg2TUlPNRosHHYifdBWZztVLn ZVICunIDuzBb/bSgCeC3qM1nhNW3IBse9xTwpcNIm6zA7qantoCB83t8MPbR6d/C C1NVGcWC89AP7sKT5s15Yzpk7Ink1CJ8GReDV87g0NGFQKCihb4MnW8AkF4nRR5O CZuIwEE3M8MDncDBErL+9K1KmHO5UnIy0FEV3lEgSmoRqgG9m/6BAMwzNXbVU3W4 CwlgcKyeFS23f++GW02OMWJVAp4VV7S7b4pxllL0zoL2ZPQZ827BYwpnKBtiOrJp Sb0U0dIKxgho+nA6R2XvdCZItN0OvjyvQK6OCNYAMtC7XEGboJJ3jBf+rkvgM4jo rpumV+1lI/urWO9rhhg2Ri318N9mWIWqIbmKYPIMrGojG3MiKBw= =rauR -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "While this is large for rc8 time but also AI driven fixes is a lot of it, we had a more traditional screw up, and a regression was just found in the fair scheduling patches that went in back in rc1. This reverts the fair scheduler back to an option and sets the default back to what it should have been. We might have been a bit overly zealous in switching over, but at least it feels more normal than the AI driven fixes. Apart from the scheduler, it's mostly amdgpu and xe fixes, with some misc fixes to the log code and connector code. scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages" * tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits) drm/log: Fix infinite loop when scale is too large for display drm/log: Fix out-of-bounds read on empty message length drm/log: Fix division by zero when scale module parameter is 0 drm/xe: Fix xe_device_probe() failure drm/xe: Fix a bug in pc_adjust_freq_bounds() drm/xe/oa: Check managed mutex initialization errors drm/xe/oa: Fix sync entry leak on OA config emit failure drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe drm/xe/pxp: add termination on resume drm/xe: Order ring writes before ring tail updates drm/xe/guc_ads: use uncached mapping for UM queue BO drm/xe/guc_ads: allocate UM queues in VRAM on dGFX drm/xe/guc_ads: allocate UM queues in a separate BO drm/xe: Fix DPT allocation paths. accel/amdxdna: Skip unmapped range in aie2_populate_range() drm/amdgpu: Prefer default discovery offset drm/amdgpu: Reject UVD message with invalid number of h265 refs drm/amdgpu: fix nbif 6.3.1 l1 low power not functional drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix ... |
||
|
Linus Torvalds
|
b26d316aaa |
Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers
- Keep audio working on Rockchip rk3588 by skipping disabling
unused clks
- Fix SpacemiT USB2 clk data so they actually work and keep the
HDMA bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert
a patch that breaks PCIe on some Qualcomm platforms
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp/RRMUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUNJw/9H0FynE4W1JnI5G4KMWJ5g3DUI+BH
y8r/Z+RiCtuwSx7rnu7rKI8Exsg6P1pT2s6Gj4CZN+xBtjDbVIC3hXty99d2VhC6
VwEvUW2/fxTYT2B0UwUNCjvxboWtVLP10DrvVrFSYF7AhYZhRNrq1XygqfXpCF5E
/v1duwPQoYsFrjCbV9eC55IL6rka7CNk1Yqm5scmGG+musPy9x/RaP1wdQbotSI/
Q/oFkNsRcM1/jo/QDVYCP4cZDPgbc+bfydj0a0dGqknW/PIueGu7dOZUIT/q+RoA
9GIcM4jEkBUHb6IVbDKPXvJClirF3kFKmjm3sAnD38MCbiA2D/pdUK6I5GFS2ieB
I1//j6qG08chWzq94HLKJ5Xpkn/L+R6btErwNmodHPgJ/+JnKJHkWWrNVmxR+Txm
YfDK2bP9fPp3Lj8bUDFAHFpWZHSbSNoGHsDrlkHyTA4qt076KGR0XxQfNMJWiVkz
oqctmn9pUJAX5bFFSlxQVs/vQAO87wIijTrIdrRLbhyHR1gu6rDBB+TvCKFokkvR
087zTihEeumyl2P/SrQl8UCXiJm98869SrvsCbfJ4Xvf0C5wwTejhjoOLJoIAJwC
UOJ1Pdi5XsLTbGXheFofeZy09UPzBWzGRxsXkYh8KGtLxi0kov2PULAPYuTMfwga
hLo5q75jO3OWxVA=
=Vc/s
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers:
- Keep audio working on Rockchip rk3588 by skipping disabling unused
clks
- Fix SpacemiT USB2 clk data so they actually work and keep the HDMA
bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert a
patch that breaks PCIe on some Qualcomm platforms"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: spacemit: k3: set hdma clock as critical
clk: spacemit: k3: fix USB2 bus clock
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
clk: rockchip: rk3588: don't disable unused I2S MCLK output gates
|
||
|
Linus Torvalds
|
06d9a86e02 |
spi: Final fixes for v7.2
A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/Vl4ACgkQJNaLcl1U h9Af0Af+J2MqcGcVuUFYO6NG9agqkqZkylfW5rPNPeEL63GqPjo2jh1YTaIiOO1X pOvWxt6Ihf0WQF7MD6WJu7N+wWe2nkVR5AIvLe9HzD5xDBYv8xLd3JQi1O4LsrjL /8aINGhuhizY+PSVQXf5mps0POGX8sb5vE9Q12bE6FCxmUgFSRMISs/dCend8qQl p7YWIQkxkpEj5OWX95iG7wz5Yt0d8JGns+1cCdRaibdKKTG6SlfaQNX0vEV7n1Dx tN3aJyOggSNS4ADed1S/pd1cZyv3663fRvYpya5nL84ynFJFKdHZvElo8AjOuUaO up15wJ4SPnabI5wepnVlNCleLluK/Q== =mKW0 -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller" * tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: virtio: mark device ready before registering the controller spi: dw: fix wrong RX_SAMPLE_DLY setting after resume spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005 |
||
|
Linus Torvalds
|
53313bf327 |
regulator: Final changes for v7.2
There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VZAACgkQJNaLcl1U h9BIiwf+OhrDj0zdVbufHV+m1+Nb8EP+UyfHfluhopSJi3dq1tY1P2Z0patUZdhU gHMizes0lq0e1xce5H4W0cqSRJGylVR9NEDYmrO+c7sePKzVWmb0lznSIrQBg6MA fMtaSfRxn1DjR78oms1h2O1qKHxFuHfIF0mKXEKYJKyKa48l3zU782xgXsXIIeXE xB+4j5DVAW4aPROT/BCsJEmfjCwLw7lwf5o1tsfgtgKO520hdJ7L6wlrHnnmSZFr g9YZDb4J9CDwHbbsBc9FCCJZw4u8rXm/fNQkVYF4DFCfodWQqPvdrB25JBYZM+Lf rOabFiJ99+29qn22bhvg80FdFQAwog== =y4W7 -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk" * tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: Fix VPOS/VNEG voltage selector table regulator: qcom-rpmh: Add support for PM8350B regulator: dt-bindings: qcom,rpmh: Add support for PM8350B |
||
|
Linus Torvalds
|
beea256806 |
regmap: Final fixes for v7.2
A couple more fixes for regmap, this time for the SoundWire MBQ support.
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that.
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VQkACgkQJNaLcl1U
h9B47Qf7BRh4U/G5/UZqHworvgBB+CUqdc/PdEzPlB7u8VmlEDixRID8tvJv4vX5
oG6dduuNnR/Op9SWD91lU0aicFQgeCPArMKYxsl9A4DRJBcYws70897yJgNdIly+
2sdTxpRhl80bL0FIBaUYOMI9Gg0LD/OuudVaLzEwyYde8M+xfQEBFEjRTPbe68Vr
yg/aAVVsefID3P0fGzbNhuiCLbhUT29K5sXxSM+LDtPk2Bz9Rrt8tBiYGtDmTBxj
J6CGe6wF7kLxLW/PPF4/eNMtnU8oGfq/X2L9G57b9q3QwHV8PcrHFKqH5GuXl1wJ
13QpamimMfyqKmcOUF5GqVbyFG7mww==
=jwlB
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"A couple more fixes for regmap, this time for the SoundWire MBQ
support:
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq"
* tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: sdw-mbq: don't call an unset readable_reg callback
regmap: sdw-mbq: Fix swap of timeout and retry times
|
||
|
Linus Torvalds
|
d2ed9eaaf2 |
MMC host:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci: Make tuning_err a signed int
- sdhci: Unmap the bounce buffer before device release
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/I6EQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKfYNEAC51HDTsIkN0SWfsxC0YT1jeo/90MViAoSm
j8HIXfdueeiV6iJcb2g9oYUKvfdstxWd4Q7Nx5rM6vRwOJqc/gPY9sTbSW/wnyqR
LdJoGSxV88dwmnk3Pc2r2SlB9pbNhFGcGime+RQ/Ri2G1pNpu5FDiFLLAI1c/Rko
5s2kuGOn8LHeezZZdVr5mPDq5Ya+SYZkUmPbdqfJO2NdxZm/XGFcV7V/vAqYizCX
UlgjbFtsSJ6lxhW7cG6IcmDZro2i8hxMZhbdip6qsnY9sazgeG7EkWqDBcqGfAhF
VbgXwk2v/kXvIbN0ygpsoUxA1LTw+Xg09h4gXx6EisQkhUJWiLpipZBNMCcezbEl
HtdfYq/omUfA3ZhvxXTJPFuaT3OqSimYHJs7FF0fbAYpVqS49ep6JeVp0zYH6tjH
Y5ydsDYj31e4e+nuBCvibIfhL3vusXGk9ehXO4kboFSe8YVd6rCz6iJYcNFYKq+B
Hif9bY6FORI1//5nnhFGCSNzyysdeO6mVtDvv08/+1JfNmtGEFQQJQmsTv4W51r+
crlONm41WfNaPFgWtNh6cEyNHJk+tVd6FlotiQnKu3QSWu6FG7vuXrRyuVyOzHYb
G5YEwFyQR1iIrgRsAm9YH084tR7pZLmFwcjXSt/LxNnTw4tGq9RjtLxGBH2GsRtt
UnyQXxL3bA==
=Ihe4
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci:
- Make tuning_err a signed int
- Unmap the bounce buffer before device release
* tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: loongson2: Fix sg iteration in data reorder functions
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
mmc: sdhci: unmap the bounce buffer before device release
mmc: sdhci: make tuning_err a signed int
|
||
|
Linus Torvalds
|
a823c9da52 |
pmdomain providers:
- arm: Don't treat performance state 0 as an error - mediatek: Fix mt8183 hang on boot - mediatek: Fix potential null pointer dereference - mediatek: Prevent using uninitialized data - mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/IjIQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKcMiEACePh2D5q9HrQfb1R1oRjTLm5ozqmR4SHNj bSJ4doCKlqLkAWR8uxeHGqk0RICnXUmeBWg72y3kp1FhymCWu7tr97/jwTtnmgP1 ztWATvb4IxkmjZE6Z+bhGZWnGiMZa2lITvWYnCzC5++dACQkLTTXlo6nBEk824/w RXw85ph/cnXilaQOH6l3T45uZolCmLJWeq+NqDoKhA5aStUmzO8+zAg53MjRpkR0 vZyemvBtrgO0ojYyI/APA4bUQFicmuZY3sXMjUHzRZNU8BWu4lsH8H8Pe3q2qVbn hUKCZmEkukKWFLyOeOMRibm3pKnEXvNuABcNL1KmyAMM91kXN1dfNaVbXUxS/3/2 /+0T4anwQfyTw0qrUUf68HtqaPrCBo9Pj/oP2BODKMORj9MsY2J1LUBNbGQvxux9 MHeT6v71eve7OV7LcQ9sZk1aM6X03BySVQsBhr5su8XQ6XuGVQqv3tTr1tLamoqd N8e0TRjJIjnqa+hu/bDHCcEIOaFDLlvBxFd9c9uLk+NRT1URDIFCzo16W+l01AYn 2XRAKtBpHNqq+2iQVhvnQIVjaijF3pasmkyUr6IsDm6QfKuI9EyJXBeoeqI0ZyQ3 PsuXhaZumFCigvWChvELMkRyScsb8Czyw0fNP2cLlTb77bL1pdXrq8AjfDCoSjp5 S0CskFrnNg== =oG0O -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - arm: Don't treat performance state 0 as an error - mediatek: - Fix mt8183 hang on boot - Fix potential null pointer dereference - Prevent using uninitialized data - Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza * tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 pmdomain: mediatek: Fix mt8183 hang on boot pmdomain: mediatek: fix remaining %pOF after of_node_put() pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE |
||
|
Linus Torvalds
|
a5161661ae |
sound fixes for 7.2
A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmp+2KkOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+2nRAAtyZCuZHuWm8ws01CDmLH5bthPVwgW0iBjnHy
mEAA0dRhwsa2lxICsAzcO8C1a+vSN3hOeQS0d+YzbCnaATj6sXMEPXDyy2NvGTWA
lRcv4HIIloDvm+cKw10jJp6p8v6n6OqP80ME34cq8c8LpLoiFDq31yGYqVekRJ+6
JyHEfyqzUCRY1wiZ9TEBnoU0I6112jWbQWhgsJxI/ZURXSBZM8r/nXfyg2cqUwIw
8P/TVhouXEvGSCdbOP7J2r3AglLBnjCcUiGx27cY9T9CJWt0hLzeYIclkZBAFIJV
l8VsiaenCNS0fHGr7fBF7gZx1WooO2724bdHxZiHmWkxNe5wOuWrqa2j66BjbiQM
EUrqpwZRO2fOg3/f2odw8VMIn+XWdszNIdDs75EoNTUZdb31sw3Ac/U1j0NBb3n2
vgXgDrZf+FSfxJ3V5+jwwrt5S2cliynj6qGMa3dObCoCP8dRKrqQoTdYMW+uMmTj
nn4bR2kjdudCJKqe6myqr9HWz8dK6XnfJbnUkYX0zBiFWrvy1yecwcyd9PEF2311
xdpdDbCXXBHvCjSo33e4wIhwd+F/tdwtonIbBpo893pC4ZTKL27Ba9quXJwu6xxB
R8MYBz7sRRlLG93a9Dixrxjp0tRrL6ZnmkW7D524rqD786D2W6sR8FpCTp4uCBwz
bkmGkgM=
=+V0F
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai"
"A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in
USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors"
* tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
ASoC: rt1320: run the initialisation preset on the first hardware init
ASoC: rt5645: Perform the initial jack detect at probe
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for NVL.
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in NVL match table
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
|
||
|
Linus Torvalds
|
c5890ac6d5 |
A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
-rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable.
-----BEGIN PGP SIGNATURE-----
iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmp/SyQTHGlkcnlvbW92
QGdtYWlsLmNvbQAKCRBKf944AhHzi+OMB/9DOUyMrxqGptG9BhzMmHPIMNE7PI+m
jHh0zEnMsE2rKaYfkLNf/p7RrcvcK4PSMCYZKXSUx0D6n3PoEccDW/JTC/rro5B/
3fZIAaZBg8B25o6b0uGjO29e7BY+WouoNAC6fU9F/DtVTnYp4bk40DsvQS6pvFiN
K2sVLIsSBhDZ7czmVlMlpc/er64TRYnWGmaxaAPMuiW5HEhWxvFDav3/r3gsP/fk
mFJ5QU4qcq/q0QmMW7gO9Q+GXjOK2+9eaplNF3wCOSdHIF2nX5knbvgu5n7a4Qoh
GNf0ak7PfFCzUoRdC/4XkMRQAO9IYgzq45EivApJQKvKmETWrzFLQ1uP
=pOld
-----END PGP SIGNATURE-----
Merge tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov:
"A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable"
* tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client:
ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
ceph: fix MDS random selection readiness predicate
libceph: Avoid using invalid osd indices from primary_temp
libceph: fix OOB read in decode_watchers() via missing bounds check
libceph: fix multiple unsafe decodes in decode_locker()
libceph: tolerate addrvecs with multiple entries of the same type
|
||
|
Linus Torvalds
|
ad8d485e66 |
vfs-7.2-rc8.fixes
Please consider pulling these changes from the signed vfs-7.2-rc8.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc olPOAP9C1jX75LIMjyoJb9lpVAvCdlrvf0wcD88NXVBylueILAEA6GC8/lVpvUX8 nSFAZojyykVsPitfUdsbLagltXwLqgU= =/Rxi -----END PGP SIGNATURE----- Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Don't warn when a mount is completed from another user namespace. fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. The task that calls fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that created the context, and mount_capable() lets it through as long as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in an ancestor namespace does. So fc->user_ns != current_user_ns() is something an unprivileged user can arrange. Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already has the same check as a plain error return in ovl_parse_param(). Drop the WARN_ON() and just refuse. Add selftests for both cases. - Reject pid allocations through dead ancestor pid namespaces. Require PIDNS_ADDING in every namespace that will receive the pid before publishing any of them. That preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. The existing ENOMEM behavior is unchanged. * tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: reject allocations through dead ancestor pid namespaces selftests/filesystems: test completing a context from another user namespace binfmt_misc: don't warn when the mount is completed from another user namespace ovl: don't warn when the mount is completed from another user namespace |
||
|
Linus Torvalds
|
97a91cc439 |
RISC-V updates for late v7.2-rc
- Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmp+hQMACgkQx4+xDQu9 KktD/hAAgVmzmzpnDwAEpENS57aWo9oNp8uihbM9Dlsi/MVzKKrT0AEsJbjifAQQ IBOIca4z+/R4TBxDif/npui/Z3JRsGzCR2iePbjmg1g78j79P3KTEihF2AN+pVnP Syx5lj6ilOMd9vvI7Akigceh+ZxNQ/OMPrfDFQtWHqyiJgy4Iskr9sM2elTsUx65 rEyYzqlHneq8L4GgeAWzzq4jbaWpEanlsGHKQ8WXC3UFdtZI70pFCrRSQ8qHx59k ZkDW280CaAUX52cqUc7W8EBgIXHG0vgfzyJ66NIumKo7eTlU0OXzLz4x41S05hep OEueIcyLMfMus7nfUZD6AeWrp4xJE0UW7aBD0COV9w1+uPJptahla8vH/NPcFLee uMuAP7S3B9Q/h3LlHUIQKIPa4jT1di2piuQZMScJokzjaEV2/xi7pt0N0kG8pHbu t1pc56KswXZzqqqHPHt9lS2NZimCnWw3ZS4mu8WJ/r/qMm7iLt2lSAySGfoCsdXi Eo3Fg2+HQr53ttm9SRUlKv6/iA3VIW60ZCz/n3eTcym7roz6HWqUqiZNmI/m6TW2 M33gGnvxm78+DxXbt5GNbHpbZQOxHM6xEZrmMwiWc4jXqh7IiD03ITMk8dq2ojNi oLm1qrv3Cv8MCXi2i/Hr+8qs+oVYm/Z6Jl7M9BsHEB1WuSPBrtw= =KAg1 -----END PGP SIGNATURE----- Merge tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests * tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: lib: Fix ZBB strnlen reading past count boundary riscv: hwprobe: Register unaligned probes before usermode riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions |
||
Gao Xiang
|
a64d500b00 |
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
CONFIG_NR_CPUS doesn't define on some UP platforms (e.g. arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n: $ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d" .config $ sed -i "/CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS.*/d" .config EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) ... Let's guard NR_CPUS with SMP instead of using a hardcoded arbitrary CPU uplimit here, similar to commit |
||
Vincent Guittot
|
333238da9a |
sched: Update time before requeueing delayed entities
In order to compute the right lag, it is required to update time to 'now'. Without this, the delayed entity might appear younger than it really is and receive less compensation for having waited. Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> |
||
Dave Airlie
|
b2601e783a |
Driver Changes:
- Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCan4Y0QAKCRC4FpNVCsYG vw4gAQD/56NgUmv0Rx3BsDCQhjCMb99DtTGbnEvhehmb6nJ0gQD/eBPPDmobVJYZ P0pGk6B014FrmH+PDjD9Vo2EbswLFQE= =ez0c -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/an4ZogmPqP2Xtfx3@fedora |
||
|
Dave Airlie
|
7581e7c73e |
drm-misc-fixes for v7.3:
- Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmp936wACgkQ/lWMcqZw E8MzVA//aKT/DVfDA9dUljxQS70lC17W0a9sf16rpQsftuRxCUci1x2kXJG5sIGa MaKdxmP8PaR0J+xNC/2rGuk2cyKiQxd4BaRnNYXHY4pLG8FbUmSbhWMrICgxj9XE DUBDXzwqjfq7lxXRsKsqARhkn4rHzb9TS84YeQaUZuuwgL2AbDeSEGZkXMTxKCuJ 0sDD8kklVNJKn4ofke5za3KWJ1gIWP/y+kosmi38kG8oZ5M3Uen6JXv/mp0VhMMd UAM+vRUFtWmkYVTsvxC9BXxdo6nqMUWRviXAeHnt6BijuysQ0ZAIuFvnf7/o+Knu NXDABvoZFuFm6pP4t3BSEX2M2RrwczxfvT465UvYaoLwgLutGxwP4AvmWE4vLe32 5pNQLpfllCkxZeOYuxewTEfWLhykxF8wnSeVy9l6II+/OpkPnUjDAFJkDHcaTk+V dPPmPZrOGC/LeLtD7JYbhRX6FkNQzTKNLjXSDjt3w/Sori3nhXkSAuj0zFDM7rHj KAnXh6B4j3vOAbqUEOHmabLqoRmlgpfP30NSyvLc47hMqvHJj+YV9V+5Ay1Yg3Sh otMusvCZY/vpwvVhlFS45XA8k81YdjnxmUqLrQceJS/KGYHt5Qzc1kP2JynjX+D7 /byp/TzTuBnO8cdXaDz58coAEPdoyfGSjH2qVYs4FgeT06ZPOYQ= =Stgd -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.3: - Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a9b38792-bdd0-42da-a46a-7a048c26c0c2@linux.intel.com |
||
|
Dave Airlie
|
c3da119ddf |
amd-drm-fixes-7.2-2026-08-12:
amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCanzNKAAKCRC93/aFa7yZ 2BTKAPwO7Y4oJfUq81w8inePMePgjCn1ML/RtKMErD0VTjfwbgD+MxbL1ABHf1Ar wyHayFAnS2mMGc+3wPoOW21E9TnL4w0= =XNgL -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.2-2026-08-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-08-12: amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260812200720.2155401-1-alexander.deucher@amd.com |
||
|
Linus Torvalds
|
2f1baf1fc8 |
tracing fixes for v7.2:
- Fix NULL pointer dereference when matching unloaded module wildcard event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in <module>.
This wildcard is represented by a NULL pointer. If one were to try to
remove the same module item with a named event it would cause a NULL
pointer dereference when comparing the NULL with the name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields
of the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex.
This may cause a data race.
Have the scan take the event_mutex to prevent the race.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan438BQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qq6EAPwNoL0MQ5Yk+rRuWIwDj33FFd3Skwe6
DfqVdxVEzCDdzAEArW2usswnZRlOCZddZPUCVj0MWdNz2sVin3p/j0Qklgg=
=W3ej
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix NULL pointer dereference when matching unloaded module wildcard
event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in
<module>. This wildcard is represented by a NULL pointer. If one were
to try to remove the same module item with a named event it would
cause a NULL pointer dereference when comparing the NULL with the
name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields of
the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex. This
may cause a data race.
Have the scan take the event_mutex to prevent the race.
* tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Fix race between update_event_fields and, event_define_fields
tracing: Fix NULL pointer dereference in module event cache removal
|
||
Michael Wu
|
c3730b8373 |
tracing: Fix race between update_event_fields and, event_define_fields
The following sequence may leads race between event_define_fields()
and update_event_fields():
CPU0 (loads module A) CPU1 (loads module B)
=============================== ===============================
load_module(A) load_module(B)
notifier_call_chain notifier_call_chain
trace_module_notify trace_module_notify
mutex_lock(&event_mutex) trace_event_update_all()
trace_module_add_events(A) down_write(&trace_event_sem)
__register_event(call_A)
__add_event_to_tracers(call_A)
event_define_fields(call_A)
for each f: list_for_each_entry(field,
list_add(&f->link, &class->fields, link)
&class->fields) field = class->fields->next;
Where access to the class->fields is not protected by the event_mutex in
trace_event_update_all().
This produces the following panic:
Unable to handle kernel access ... at virtual address 0000000000000018
pc : update_event_fields+0xf8/0x368
Call trace:
update_event_fields+0xf8/0x368
trace_event_update_all+0x7c/0x2b4
trace_module_notify+0x4c/0x1dc
notifier_call_chain+0x84/0x168
blocking_notifier_call_chain_robust+0x64/0xd4
load_module+0x10c8/0x123c
__arm64_sys_finit_module+0x230/0x31c
Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.
Cc: stable@vger.kernel.org
Fixes:
|
||
Hui Su
|
b69859204d |
tracing: Fix NULL pointer dereference in module event cache removal
A module-only event filter such as ":mod:foo" is cached with a NULL
event_mod->match when foo has not been loaded. If a later write tries to
remove a specific match from the same module, remove_cache_mod() passes
the NULL cached match to strcmp(), causing a NULL pointer dereference.
The issue can be reproduced from userspace:
echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event
echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event
The second write must be a concatenation (">>") to not include O_TRUNC as
that would cause ftrace_clear_events() to clear the cached modules lines.
The crash was reproduced on x86_64 QEMU while KUnit workers contended on
the event tracing path:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
RIP: 0010:strcmp+0x10/0x30
Call Trace:
__ftrace_set_clr_event_nolock+0x373/0x4a0
ftrace_set_clr_event+0xf0/0x180
ftrace_event_write+0xdf/0x110
vfs_write+0xf6/0x440
ksys_write+0x68/0xe0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Check event_mod->match before comparing it, consistent with the existing
NULL checks for the cached system and event fields. The mismatched removal
continues to return -EINVAL; a broad cached module filter is removed with
"!:mod:<module>".
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811173902.1927376-2-sh_def@163.com
Fixes:
|
||
Jasper Wise
|
11058bd3d4 |
spi: virtio: mark device ready before registering the controller
virtio_spi_probe() registers the SPI controller with devm_spi_register_controller(). spi_register_controller() binds a child inline unless its driver has asked for asynchronous probing, so a peripheral that performs a transfer during its own probe reaches virtio_spi_transfer_one(), which kicks the virtqueue before probe has returned. The driver never calls virtio_device_ready(), so DRIVER_OK is set on its behalf by virtio_dev_probe(), only once probe has returned. The virtio spec is explicit about that ordering in 3.1 Device Initialization: | The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK. A device that waits for DRIVER_OK before servicing the queue therefore leaves the transfer unanswered, and virtio_spi_transfer_one() waits for its completion with no timeout, so probe never returns. Mark the device ready before registering the controller, as done for the same reason in commit |
||
Mikhail Gavrilov
|
3aa1dcaa4f |
Revert "wifi: mt76: Disable napi when removing device"
This reverts commit |
||
|
Linus Torvalds
|
e14aacefb7 |
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Including fixes from netfilter.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge().
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- sched: act_ct: fix sk_buff leak when the header checks reject a packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth: veth: fix queue index used to wake the peer txq in veth_poll
- eth: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- eth: gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
- eth: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmp93xcSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkMMEP/AyjDJBRLMNyKkqY5lEK1ZvPqgaCTWuE
U/A8ZBxveuCmRDCWkEJhQp2bQHuwJsqW9wYmFob8eEEsAmjey7362t3z7OxKuq7x
kL8MOpkSY7MyB1kJBrzNMhBSHtSfbRQ/6vqJApoeXkMYxldi9NKvT1pndVwx1vdZ
G0dVD0dMTR/bWuALfg1aQXAHziACL7eR19eJ/IR9IF2F+Tqi8LgrZpiv0FT9ZU8G
vHeX9P1WpiorU4nnyqpBoNNpam3mTupcXg+ScqSKlkYKUCZV8ILA0rLZijZxXTrK
WbO7VxzAjwoz//GMTHAdnw4m0lsPVpCXGzWm/CIUQ/Z1OO04NXGru6LPOlsgufZ1
LNtbon7+GJ3JWl54/cvBYuDMBaYY+9CW6WdiWdlQuxlaZmixAWpbSxCZuwZMlV9Z
5HRhQfbg1N20zSTNnmKi5o6uwWOWxpQpxIwDkmPlDIpFPX2HtD+gNJ8UqHwIhgcG
j6h2oP2up6PS6NxtWm5+UFXqrwL/0AyI1R5x5hdbOO2rfyfcDDec4eo+qhrOhnkq
uKvBADD4b9zO7hllOz/XQ0uDYfylZlnp4Gx3+6JMYkqeMbk+TmSxrras+g6jnPyk
gTQ9MK2RHoFywDGMiNebDUJAX/fNWxWywzyzuY3izW4B1jho9YGMSLilaJ/xDDQ9
AL7fWaTpvCty
=asb8
-----END PGP SIGNATURE-----
Merge tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from netfilter.
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge()
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
path
- sched: act_ct: fix sk_buff leak when the header checks reject a
packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth:
- veth: fix queue index used to wake the peer txq in veth_poll
- ngbe: fix NULL pointer dereference in non-MSI-X interrupt
enabling
- gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth:
- bnxt: avoid deadlock when canceling IRQ affinity notifier
- ipvlan: inherit needed_headroom and needed_tailroom from
phy_dev"
* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
l2tp: fix tunnel and session refcount leak on seq_file release
net/sched: cls_bpf: reject dev-bound programs bound to a different device
sctp: fix use-after-free of cached ASCONF chunk
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
sctp: clear new_transport when removing a peer
net/dibs: Correct freeing of dmb_clientid_arr
net/sched: cls_u32: skip hash tables in u32_bind_class()
gve: fix NULL dereference due to missing ptp adjfine
gve: fix zero-length skb frag with header-split
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
af_packet: Don't send zero-byte data in tpacket_snd().
tipc: read le->link under the node lock in tipc_node_link_down()
selftests: tls: cover splice after a failed decrypt
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
net: tap: fix wrong transport_header when sending VLAN-tagged frame
net: packet: fix wrong transport_header when sending VLAN-tagged frame
vxlan: do not arm the ageing timer on a device that is down
ipv4: fix use-after-free in fib_nhc_update_mtu()
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
...
|
||
|
Linus Torvalds
|
83a4f90e98 |
firewire fixes for 7.2-final
Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCan2ycwAKCRCsLtaWM8Lw ExX4APkBTU8zkvG/Gy7oSsFtLZWmy2BXkWxh88PiLkbs2GG3sgEA/x9Y43ysmoM+ OTLeNES8O/tmGjGrq8tZxfYL+AjCCg0= =l4pB -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller" * tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: ohci: fix NULL pointer dereference in ar_context_release |
||
|
Linus Torvalds
|
b4f5144d37 |
gpio fixes for v7.2
- use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer -----BEGIN PGP SIGNATURE----- iQIyBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmp9fVYACgkQBZ0uy/82 hMM2bg/4lIfsWQF7GiSs7cgOa/J0DNIo1PZuf2h9cSJYuR10gMBszCVrBrM/qFT0 05MbJGQcaPSW8Zq8QwR+BoaZ20d64iXuipWOkqg53lN5whU28Tm2z2/YFdC/UHAO niXbIstc4d26mm1hc6AwjGV4p6lgzTR2W+IcbkImUAAUQDJX+YE6iasclL2EViz5 fufRQ2VaF159AD5zeNjMxoYRwGlZGAU+qeXwbYDhkt0CBOhAZ0eUhnyQi8zYcnpN OsKmqRplq/tm6jdUjGBoHOFWoXnp4QdukvyEHP/M56WfxyYPOcc9ABCMK45MqpvX b+9eAy0LjQg+38D6geQIP53ZzVKUrbg4NnLItGV8ad6WR9e0t8+xm0c01hKQ9fdw n5R12KMr2OdYjSjq1MAuBbUSRrwBjwdgZuxcE5fo3w0aLYfaVAX9LoFkpuv8WP/U hSUuO9cMxLRnb2ckDVCoazI4lBNuBG2E7si3eodPkFfU6UoiAN8+TQFW3O1AeOnz LDFMnRb3EADMC4LFdnYSUiQRRm0mHnjhLj1BNZ4Rjgd3ZEgfsHv7ez2JNtIyJs5F r7H4XBMH1cthyaIkdXWPoKPyE2AJiEg9g0KyvNTHqp2+ORDtz7o3m11AsXDAjGZm y22YVJUPKUwqVzAabOuoJY872fPQ1N9Zkf9aLrGWNL9MvI+bAw== =Mmpx -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer * tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind gpio: ml-ioh: share the register lock across channels gpio: ml-ioh: use raw_spinlock_t for the register lock gpiolib: Check gc->get_direction() before calling gpiod_get_direction() |
||
|
Linus Torvalds
|
64dc3ba55e |
m68k fixes for v7.2
- m68k: Define NR_CPUS to 1. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCan13fAAKCRCKwlD9ZEnx cIo6AP9d3BCY2IMGKEHyeF/W+KUtQ5Abgmpe3IW+aztsxtsZgwD+MR6iM0TIaTg+ e5zlvNICBmIiKHDo3sD1vSssHB3WaQU= =VhE7 -----END PGP SIGNATURE----- Merge tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: "Define NR_CPUS to 1. This fixes a long-standing but never critical before oddity on m68k, that turned into a serious configuration issue after a recent erofs change" * tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Define NR_CPUS to 1 |